The LinkedIn SC plugin for WordPress is vulnerable to a stored cross‑site scripting flaw that permits the ‘linkedin_sc_date_format’, ‘linkedin_sc_api_key’, and ‘linkedin_sc_secret_key’ inputs to contain arbitrary JavaScript. The lack of input sanitization and output escaping means that any script injected in these fields is stored in the database and later rendered on the settings page, causing it to execute whenever a user accesses that page.

All installations of the LinkedIn SC plugin distributed by guillaumev that use a version up to and including 1.1.9 are affected. WordPress sites running these versions and using the settings page are at risk.

The CVSS score of 4.4 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of public exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must first possess administrator‑level or higher privileges, then edit the plugin settings to add malicious code. Once stored, the payload runs on subsequent page views by any user who accesses the affected page, making containment difficult without a patch or input sanitization.